Vulnerability · Published Aug 25, 2026 · Assigned by vmware
CVE-2026-41707Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
High 7.4
In plain English
A high-severity security flaw in Spring Security from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Security | 7.1.07.0.0 – through 7.0.66.5.0 – through 6.5.11 |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N